@hasna/skills 0.10.24 → 0.10.26

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.24",
+  version: "0.10.26",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.24",
+  version: "0.10.26",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.24",
+  version: "0.10.26",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.js

@@ -9051,6 +9051,18 @@ function assertAgentPolicyCollections(policy) {
       if (control.appSha256 !== undefined)
         requireBound(typeof control.appSha256 === "string" && /^[a-f0-9]{64}$/.test(control.appSha256));
     }
+  if (bridge.codexInactivePlugins !== undefined) {
+    const controls = array(bridge.codexInactivePlugins, 4096), ids = new Set;
+    requireBound(controls.length === 0 || object(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === "codex-cli 0.160.0" && typeof bridge.codexPluginSkillReview.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(bridge.codexPluginSkillReview.catalogSha256));
+    for (const control of controls) {
+      requireBound(object(control) && Object.keys(control).every((key) => ["pluginId", "namespace", "pluginParent", "sourceType", "sourceSha256"].includes(key)));
+      text(control.pluginId, 1024);
+      text(control.namespace, 64);
+      text(control.pluginParent);
+      requireBound(!ids.has(control.pluginId) && isAbsolute2(control.pluginParent) && resolve2(control.pluginParent) === control.pluginParent && ["local", "git", "npm"].includes(control.sourceType) && typeof control.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(control.sourceSha256));
+      ids.add(control.pluginId);
+    }
+  }
   if (bridge.disabledBuiltins !== undefined)
     for (const builtin of array(bridge.disabledBuiltins, AGENT_POLICY_LIMITS.builtinNames)) {
       requireBound(object(builtin));
@@ -9063,6 +9075,25 @@ function assertAgentPolicyCollections(policy) {
     text(agent, 128);
     requireBound(object(value));
     text(value.agent, 128);
+    if (value.codexInstallationInputs !== undefined) {
+      const proof = record(value.codexInstallationInputs, 4), inputs = array(proof.plugins, 4096), ids = new Set;
+      requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && proof.version === "codex-cli 0.160.0" && typeof proof.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(proof.catalogSha256) && inputs.length > 0 && object(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === proof.version && bridge.codexPluginSkillReview.catalogSha256 === proof.catalogSha256);
+      for (const input of inputs) {
+        requireBound(object(input) && Object.keys(input).every((key) => ["pluginId", "namespace", "pluginParent", "sourceRoot", "sourceSha256"].includes(key)));
+        text(input.pluginId, 1024);
+        text(input.namespace, 64);
+        text(input.pluginParent);
+        text(input.sourceRoot);
+        requireBound(!ids.has(input.pluginId) && [input.pluginParent, input.sourceRoot].every((path) => isAbsolute2(path) && resolve2(path) === path) && typeof input.sourceSha256 === "string" && /^[a-f0-9]{64}$/.test(input.sourceSha256));
+        ids.add(input.pluginId);
+      }
+      if (proof.directories !== undefined)
+        for (const directory of array(proof.directories, AGENT_POLICY_LIMITS.discoveryDirectories)) {
+          requireBound(object(directory));
+          text(directory.path);
+          requireBound(directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256));
+        }
+    }
     for (const root of array(value.roots, AGENT_POLICY_LIMITS.discoveryRoots))
       text(root);
     for (const source of array(value.sources, AGENT_POLICY_LIMITS.discoverySources)) {
@@ -9384,7 +9415,7 @@ function safe(path) {
 function same(before, after) {
   return Boolean(after && after.isDirectory() && before.dev === after.dev && before.ino === after.ino && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs);
 }
-function capture(path, budget) {
+function capture(path, budget, excludedRoots) {
   safe(path);
   const root = lstatSync4(path, { throwIfNoEntry: false });
   if (!root)
@@ -9413,7 +9444,7 @@ function capture(path, budget) {
       budget.bytes += Buffer.byteLength(row);
       need(budget.bytes <= AGENT_POLICY_LIMITS.discoveryDirectoryBytes, "Native discovery directory metadata limit exceeded");
       hash.update(row);
-      if (stat.isDirectory())
+      if (stat.isDirectory() && !excludedRoots.includes(child))
         walk(child, childRelative, stat, depth + 1);
     }
     need(same(before, lstatSync4(current, { throwIfNoEntry: false })), "Native discovery directory changed while reading");
@@ -9422,16 +9453,18 @@ function capture(path, budget) {
   safe(path);
   return { path, sha256: hash.digest("hex") };
 }
-function captureDiscoveryDirectories(paths) {
+function captureDiscoveryDirectories(paths, excludedRoots = []) {
   need(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid native discovery directory collection");
   const budget = { entries: 0, bytes: 0 };
-  return paths.map((path) => capture(path, budget));
+  for (const root of excludedRoots)
+    safe(root);
+  return paths.map((path) => capture(path, budget, excludedRoots));
 }
-function verifyDiscoveryDirectories(directories) {
+function verifyDiscoveryDirectories(directories, excludedRoots = []) {
   need(Array.isArray(directories) && directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid native discovery directory collection");
   for (const directory of directories)
     need(directory && typeof directory === "object" && (directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256)), "Invalid native discovery directory digest");
-  const current = captureDiscoveryDirectories(directories.map((directory) => directory.path));
+  const current = captureDiscoveryDirectories(directories.map((directory) => directory.path), excludedRoots);
   for (let i = 0;i < directories.length; i++)
     need(current[i].sha256 === directories[i].sha256, `Native discovery directory membership changed; run skills hook install with a fresh discovery review: ${directories[i].path}`);
 }
@@ -10881,7 +10914,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.24",
+  version: "0.10.26",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -13197,6 +13230,10 @@ async function connectCodexHookRpc(options) {
 }
 
 // src/lib/codex-native-skill-catalog.ts
+function codexPluginSourceIsConfigControlled(plugin) {
+  const remoteRealms = ["openai-curated-remote", "created-by-me-remote", "workspace-directory", "workspace-shared-with-me", "workspace-shared-with-me-private", "workspace-shared-with-me-unlisted"];
+  return Boolean(plugin.sourceType && ["local", "git", "npm"].includes(plugin.sourceType) && plugin.sourceSha256 && /^[a-f0-9]{64}$/.test(plugin.sourceSha256) && !plugin.remotePluginId && !remoteRealms.includes(plugin.id.slice(plugin.id.lastIndexOf("@") + 1)));
+}
 var MAX_SKILLS = 4096;
 var MAX_NAME_BYTES = 1024;
 var MAX_PATH_BYTES = 16384;
@@ -13208,6 +13245,15 @@ var object4 = (value) => value !== null && typeof value === "object" && !Array.i
 var scalar = (value, max) => typeof value === "string" && value.length > 0 && value.trim() === value && Buffer.byteLength(value, "utf8") <= max && !/[\u0000-\u001f\u007f]/u.test(value);
 var remotePluginIdentifier = (value) => typeof value === "string" && /^[A-Za-z0-9_~-]{1,1024}$/.test(value);
 var absolutePath2 = (value) => scalar(value, MAX_PATH_BYTES) && isAbsolute10(value);
+function projectPluginSource(source) {
+  if (!object4(source))
+    return {};
+  if (source.type === "remote")
+    return { sourceType: "remote" };
+  const optionalText = (value) => value === undefined || value === null || scalar(value, MAX_PATH_BYTES);
+  const valid = source.type === "local" ? Object.keys(source).every((key) => ["type", "path"].includes(key)) && absolutePath2(source.path) : source.type === "git" ? Object.keys(source).every((key) => ["type", "url", "path", "refName", "sha"].includes(key)) && scalar(source.url, MAX_PATH_BYTES) && [source.path, source.refName, source.sha].every(optionalText) : source.type === "npm" ? Object.keys(source).every((key) => ["type", "package", "version", "registry"].includes(key)) && scalar(source.package, MAX_NAME_BYTES) && [source.version, source.registry].every(optionalText) : false;
+  return valid ? { sourceType: source.type, sourceSha256: hashNativeJsonControls(JSON.stringify(source)), ...source.type === "local" ? { sourcePath: source.path } : {} } : {};
+}
 function projectCodexNativeSkillCatalog(response, cwd) {
   if (!absolutePath2(cwd) || !object4(response) || !Array.isArray(response.data) || response.data.length !== 1)
     refuse();
@@ -13237,7 +13283,10 @@ function projectCodexInstalledPlugins(response) {
       plugins.push({
         ...value,
         marketplace: marketplace.name,
-        sourceType: object4(value.source) && value.source.type === "remote" ? "remote" : undefined
+        sourceType: undefined,
+        sourceSha256: undefined,
+        sourcePath: undefined,
+        ...projectPluginSource(value.source)
       });
     }
   }
@@ -13248,7 +13297,7 @@ function projectCodexInstalledPluginEntries(value) {
     refuse();
   const ids = new Set;
   return value.map((item) => {
-    if (!object4(item) || !scalar(item.id, MAX_PLUGIN_ID_BYTES) || !scalar(item.name, MAX_NAME_BYTES) || typeof item.installed !== "boolean" || typeof item.enabled !== "boolean" || item.localVersion !== null && !scalar(item.localVersion, MAX_NAME_BYTES) || item.remotePluginId !== undefined && item.remotePluginId !== null && !remotePluginIdentifier(item.remotePluginId) || item.sourceType !== undefined && item.sourceType !== "remote")
+    if (!object4(item) || !scalar(item.id, MAX_PLUGIN_ID_BYTES) || !scalar(item.name, MAX_NAME_BYTES) || typeof item.installed !== "boolean" || typeof item.enabled !== "boolean" || item.localVersion !== null && !scalar(item.localVersion, MAX_NAME_BYTES) || item.remotePluginId !== undefined && item.remotePluginId !== null && !remotePluginIdentifier(item.remotePluginId) || item.sourceType !== undefined && !["remote", "local", "git", "npm"].includes(item.sourceType) || (["local", "git", "npm"].includes(item.sourceType) ? typeof item.sourceSha256 !== "string" || !/^[a-f0-9]{64}$/.test(item.sourceSha256) : item.sourceSha256 !== undefined) || (item.sourceType === "local" ? !absolutePath2(item.sourcePath) || normalize2(item.sourcePath) !== item.sourcePath || item.sourceSha256 !== hashNativeJsonControls(JSON.stringify({ type: "local", path: item.sourcePath })) : item.sourcePath !== undefined))
       refuse();
     const at = item.id.lastIndexOf("@");
     if (at < 1 || item.id.slice(0, at) !== item.name || at === item.id.length - 1 || ids.has(item.id))
@@ -13260,7 +13309,9 @@ function projectCodexInstalledPluginEntries(value) {
       installed: item.installed,
       enabled: item.enabled,
       localVersion: item.localVersion ?? null,
-      ...item.sourceType === "remote" ? { sourceType: "remote" } : {},
+      ...item.sourceType === undefined ? {} : { sourceType: item.sourceType },
+      ...item.sourceSha256 === undefined ? {} : { sourceSha256: item.sourceSha256 },
+      ...item.sourcePath === undefined ? {} : { sourcePath: item.sourcePath },
       ...item.remotePluginId == null ? {} : { remotePluginId: item.remotePluginId }
     };
   });
@@ -13473,7 +13524,7 @@ function rootControls(root, read2) {
   const appSha256 = present ? appControls(app, read2) : undefined;
   return { namespace: manifest.name, manifestSha256, ...appSha256 ? { appSha256 } : {}, ...mcpSha256 ? { mcpSha256 } : {} };
 }
-function identity3(document2, cache, read2) {
+function documentIdentity(document2, cache, read2) {
   if (!document2.startsWith(cache + sep4) || !document2.endsWith(sep4 + "SKILL.md"))
     refuse2();
   const text2 = read2(document2);
@@ -13501,11 +13552,33 @@ function identity3(document2, cache, read2) {
     const path = join14(root, ".codex-plugin", "plugin.json");
     if (!lstatSync12(path, { throwIfNoEntry: false }))
       continue;
-    const controls = rootControls(root, read2);
-    return { name: `${controls.namespace}:${front.name}`, pluginParent: dirname10(root), ...controls };
+    const manifestFile = lstatSync12(path);
+    if (!lstatSync12(join14(root, ".codex-plugin")).isDirectory() || !manifestFile.isFile() || manifestFile.size > 1024 * 1024)
+      refuse2();
+    let manifest;
+    try {
+      const text3 = read2(path);
+      hashNativeJsonControls(text3);
+      manifest = JSON.parse(text3);
+    } catch {
+      refuse2();
+    }
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || !identifier2(manifest.name))
+      refuse2();
+    const declaredVersion = manifest.version === undefined ? "" : typeof manifest.version === "string" ? manifest.version.trim() : null;
+    if (declaredVersion === null || (declaredVersion ? declaredVersion !== basename5(root) : basename5(root) !== CODEX_DEFAULT_AGENT_PLUGIN_VERSION))
+      refuse2();
+    return { name: `${manifest.name}:${front.name}`, namespace: manifest.name, pluginParent: dirname10(root), root };
   }
   refuse2();
 }
+function identity3(document2, cache, read2) {
+  const parsed = documentIdentity(document2, cache, read2);
+  const controls = rootControls(parsed.root, read2);
+  if (controls.namespace !== parsed.namespace)
+    refuse2();
+  return { name: parsed.name, pluginParent: parsed.pluginParent, ...controls };
+}
 function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read2) {
   if (!Array.isArray(controls) || controls.length > 4096)
     return false;
@@ -13543,11 +13616,13 @@ function reviewedCodexPluginCapabilitiesUnchanged(cache, controls, read2) {
     return false;
   }
 }
-function reviewCodexPluginSkillControls(catalog, documents, cache, cwd, read2, rules) {
+function reviewCodexPluginControls(catalog, documents, cache, cwd, read2, rules, pluginSettings) {
   if (!supportsCodexNativeCapability(catalog?.version, "qualified-skill-catalog") || catalog.cwd !== cwd)
     refuse2();
   const skills = projectCodexNativeSkillCatalog({ data: [{ cwd, errors: [], skills: catalog.skills }] }, cwd);
-  const allowed = new Set(documents), result = [];
+  const allowed = new Set(documents), result = [], inertDocuments = new Set;
+  const inactivePlugins = new Map;
+  const sourceInputs = new Map;
   let installedPlugins;
   try {
     installedPlugins = projectCodexInstalledPluginEntries(catalog.plugins ?? []);
@@ -13558,25 +13633,48 @@ function reviewCodexPluginSkillControls(catalog, documents, cache, cwd, read2, r
   for (const document2 of candidates) {
     if (!document2.startsWith(cache + sep4))
       continue;
-    const parsed = identity3(document2, cache, read2);
-    if (parsed.name === "skills-cli" || parsed.name.endsWith(":skills-cli"))
+    const located = documentIdentity(document2, cache, read2);
+    if (located.name === "skills-cli" || located.name.endsWith(":skills-cli"))
       refuse2();
-    const cacheParts = relative4(cache, parsed.pluginParent).split(sep4);
+    const cacheParts = relative4(cache, located.pluginParent).split(sep4);
     if (cacheParts.length !== 2 || cacheParts.some((part) => !identifier2(part)))
       refuse2();
     const [marketplace, pluginName] = cacheParts;
-    if (pluginName !== parsed.namespace)
+    if (pluginName !== located.namespace)
       refuse2();
     const expectedPluginId = `${pluginName}@${marketplace}`;
     const listed = skills.filter((skill) => skill.path === document2);
     if (listed.length > 1)
       refuse2();
+    const installed = installedPlugins.filter((plugin) => plugin.id === expectedPluginId && plugin.name === pluginName);
+    if (catalog.version === "codex-cli 0.160.0" && installed.length === 1 && installed[0].installed && installed[0].localVersion === basename5(located.root) && installed[0].sourceType === "local" && codexPluginSourceIsConfigControlled(installed[0])) {
+      const plugin = installed[0], input = { pluginId: expectedPluginId, namespace: located.namespace, pluginParent: located.pluginParent, sourceRoot: plugin.sourcePath, sourceSha256: plugin.sourceSha256 };
+      if (input.sourceRoot !== located.root && !input.sourceRoot.startsWith(cache + sep4) && (lstatSync12(input.sourceRoot, { throwIfNoEntry: false }) || documents.some((path) => path.startsWith(input.sourceRoot + sep4)))) {
+        if (skills.some((skill) => skill.path === input.sourceRoot || skill.path.startsWith(input.sourceRoot + sep4)) || !sourceInputUnchanged(input, cache, read2))
+          refuse2();
+        sourceInputs.set(expectedPluginId, input);
+      }
+    }
+    const settings = pluginSettings && typeof pluginSettings === "object" && !Array.isArray(pluginSettings) ? pluginSettings : undefined;
+    if (catalog.version === "codex-cli 0.160.0" && !listed.length && !skills.some((skill) => skill.pluginId === expectedPluginId) && installed.length === 1 && installed[0].installed && !installed[0].enabled && codexPluginSourceIsConfigControlled(installed[0]) && settings && Object.hasOwn(settings, expectedPluginId) && settings[expectedPluginId]?.enabled === false) {
+      if (!Array.isArray(rules))
+        refuse2();
+      const exactPathDeny = rules.some((rule) => rule?.path === document2 && rule?.enabled === false);
+      if (!lstatSync12(document2).isFile() || realpathSync5(document2) !== document2 || realpathSync5(located.root) !== located.root || realpathSync5(located.pluginParent) !== located.pluginParent || realpathSync5(join14(located.root, ".codex-plugin/plugin.json")) !== join14(located.root, ".codex-plugin/plugin.json") || !exactPathDeny || rules.some((rule) => typeof rule?.name === "string" && rule.name.trim() === located.name && rule?.enabled !== false) || !isCodexNativeSkillDisabled({ name: located.name, path: document2, pluginId: expectedPluginId, enabled: true }, rules))
+        refuse2();
+      inertDocuments.add(document2);
+      const plugin = installed[0];
+      inactivePlugins.set(expectedPluginId, { pluginId: expectedPluginId, namespace: located.namespace, pluginParent: located.pluginParent, sourceType: plugin.sourceType, sourceSha256: plugin.sourceSha256 });
+      continue;
+    }
+    const parsed = { name: located.name, pluginParent: located.pluginParent, ...rootControls(located.root, read2) };
+    if (parsed.namespace !== located.namespace)
+      refuse2();
     let remotePluginId;
     if (listed.length === 1) {
       if (listed[0].name !== parsed.name || listed[0].pluginId !== expectedPluginId)
         refuse2();
     } else {
-      const installed = installedPlugins.filter((plugin2) => plugin2.id === expectedPluginId && plugin2.name === pluginName);
       if (installed.length !== 1 || !installed[0].installed || !installed[0].enabled)
         refuse2();
       const plugin = installed[0];
@@ -13594,9 +13692,48 @@ function reviewCodexPluginSkillControls(catalog, documents, cache, cwd, read2, r
     }
     result.push({ ...parsed, pluginId: expectedPluginId, ...remotePluginId ? { remotePluginId } : {} });
   }
-  if (!result.length && documents.some((document2) => document2.startsWith(cache + sep4)) || new Set(result.map((item) => item.name)).size !== result.length)
+  if (!result.length && documents.some((document2) => document2.startsWith(cache + sep4) && !inertDocuments.has(document2)) || new Set(result.map((item) => item.name)).size !== result.length)
     refuse2();
-  return result;
+  return { skills: result, inactivePlugins: [...inactivePlugins.values()], sourceInputs: [...sourceInputs.values()] };
+}
+function sourceInputUnchanged(input, cache, read2) {
+  try {
+    const parts = relative4(cache, input.pluginParent).split(sep4);
+    if (parts.length !== 2 || parts.some((part) => !identifier2(part)) || parts[1] !== input.namespace || input.pluginId !== `${parts[1]}@${parts[0]}` || !codexPluginSourceIsConfigControlled({ id: input.pluginId, sourceType: "local", sourceSha256: input.sourceSha256 }) || input.sourceSha256 !== hashNativeJsonControls(JSON.stringify({ type: "local", path: input.sourceRoot })) || resolve9(input.sourceRoot) !== input.sourceRoot || !lstatSync12(input.sourceRoot).isDirectory() || realpathSync5(input.sourceRoot) !== input.sourceRoot || input.sourceRoot === cache || input.sourceRoot.startsWith(cache + sep4) || cache.startsWith(input.sourceRoot + sep4))
+      return false;
+    const path = join14(input.sourceRoot, ".codex-plugin/plugin.json"), stat = lstatSync12(path);
+    if (!stat.isFile() || stat.size > 1024 * 1024 || realpathSync5(path) !== path)
+      return false;
+    const text2 = read2(path);
+    hashNativeJsonControls(text2);
+    const manifest = JSON.parse(text2);
+    return Boolean(manifest && typeof manifest === "object" && !Array.isArray(manifest) && manifest.name === input.namespace);
+  } catch {
+    return false;
+  }
+}
+function reviewedCodexPluginSourceRoots(cache, inputs, read2) {
+  if (!Array.isArray(inputs) || inputs.length > 4096 || new Set(inputs.map((input) => input.pluginId)).size !== inputs.length || new Set(inputs.map((input) => input.sourceRoot)).size !== inputs.length || inputs.some((input) => !sourceInputUnchanged(input, cache, read2)))
+    refuse2();
+  const roots = inputs.map((input) => input.sourceRoot);
+  if (roots.some((root) => roots.some((other) => root !== other && root.startsWith(other + sep4))))
+    refuse2();
+  return roots;
+}
+function isReviewedCodexPluginInactive(document2, cache, controls, pluginSettings, rules, read2) {
+  if (!Array.isArray(controls) || controls.length > 4096 || !pluginSettings || typeof pluginSettings !== "object" || Array.isArray(pluginSettings) || !Array.isArray(rules))
+    return false;
+  try {
+    const parsed = documentIdentity(document2, cache, read2), matches = controls.filter((control2) => control2.pluginParent === parsed.pluginParent && control2.namespace === parsed.namespace);
+    if (matches.length !== 1 || !lstatSync12(document2).isFile() || realpathSync5(document2) !== document2 || realpathSync5(parsed.root) !== parsed.root || realpathSync5(parsed.pluginParent) !== parsed.pluginParent || realpathSync5(join14(parsed.root, ".codex-plugin/plugin.json")) !== join14(parsed.root, ".codex-plugin/plugin.json"))
+      return false;
+    const control = matches[0], parts = relative4(cache, parsed.pluginParent).split(sep4);
+    if (parts.length !== 2 || parts.some((part) => !identifier2(part)) || parts[1] !== parsed.namespace || control.pluginId !== `${parts[1]}@${parts[0]}` || !codexPluginSourceIsConfigControlled({ ...control, id: control.pluginId }) || !Object.hasOwn(pluginSettings, control.pluginId) || pluginSettings[control.pluginId]?.enabled !== false)
+      return false;
+    return !rules.some((rule) => (rule?.path === document2 || typeof rule?.name === "string" && rule.name.trim() === parsed.name) && rule?.enabled !== false);
+  } catch {
+    return false;
+  }
 }
 function isReviewedCodexPluginSkillDisabled(document2, cache, controls, rules, read2) {
   if (!document2.startsWith(cache + sep4) || !Array.isArray(controls) || controls.length > 4096)
@@ -14540,6 +14677,9 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
     for (const [agent, path] of rootDefinitions)
       roots.push([agent, canonicalAgentPath(join17(project, path), aliases)]);
   }
+  const installationInputs = options.codexInstallationInputRoots ?? [];
+  if (installationInputs.some((input) => resolve10(input) !== input || realpathSync6(input) !== input || roots.some(([agent, path]) => agent === "codex" && (path === input || path.startsWith(input + sep5) || input.startsWith(path + sep5)))))
+    throw new Error("Native installation input overlaps an unconditional skill-loading root");
   const entries = [], seen = new Set;
   const cacheScans = new Map, maxAliasProofEntries = 1e4;
   let discoveryEntries = 0, discoveryPathBytes = 0;
@@ -14574,11 +14714,13 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
     }
     return true;
   }
-  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false) {
+  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false, configuredRoot = false) {
     if (!admitted)
       admit(path);
     const scan = { complete: true, hasSkills: false, entries: 1 };
     assertSafePath(path);
+    if (configuredRoot && agent === "codex" && installationInputs.some((root) => path === root || path.startsWith(`${root}${sep5}`)))
+      return scan;
     if (!existsSync8(path))
       return scan;
     const stat = lstatSync15(path);
@@ -14634,7 +14776,7 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
           continue;
         }
       }
-      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true);
+      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true, configuredRoot);
       scan.complete &&= childScan.complete;
       scan.hasSkills ||= childScan.hasSkills;
       scan.entries += childScan.entries;
@@ -14643,10 +14785,10 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
       cacheScans.set(path, scan);
     return scan;
   }
-  function scanRoot(agent, path, vendor = false, pluginCache = false) {
+  function scanRoot(agent, path, vendor = false, pluginCache = false, configuredRoot = false) {
     if (agent === "hermes" || options.guardHermes && `${path}${sep5}`.includes(`${sep5}.agents${sep5}skills${sep5}`))
       assertNoHermesLegacyShadow(path);
-    if (!visit2(agent, path, vendor, 0, pluginCache).complete)
+    if (!visit2(agent, path, vendor, 0, pluginCache, false, configuredRoot).complete)
       throw new Error(`Native skill discovery limit exceeded; review this root before continuing: ${path}`);
   }
   for (const [agent, path] of roots)
@@ -14662,7 +14804,7 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
   const configured = options.configured ? INTEGRATION_AGENTS.filter(includesAgent).flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
   for (const root of [...options.agentRoots ?? [], ...configured])
     if (includesAgent(root.agent))
-      scanRoot(root.agent, canonicalAgentPath(root.path, aliases), true);
+      scanRoot(root.agent, canonicalAgentPath(root.path, aliases), true, false, true);
   if (options.reviewedCacheAlias !== undefined && !reviewedCacheAliasFound)
     throw new Error("Reviewed cache alias was not an inventoried skill-containing sibling alias");
   recheckRootAliases(aliases);
@@ -14802,6 +14944,11 @@ enabled = false
   Bun.TOML.parse(result);
   return result;
 }
+function assertCodexInstallationInputs(home, projectDirs, inputs) {
+  const nativeRoots = [home, ...projectAncestorDirectories(projectDirs)].flatMap((directory) => ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => resolve10(directory, path)));
+  if (inputs.some((input) => nativeRoots.some((root) => root === input || root.startsWith(input + sep5) || input.startsWith(root + sep5))))
+    throw new Error("Native installation input overlaps an unconditional skill-loading root");
+}
 function planAgentIntegration(options) {
   const home = options.home ?? homedir2(), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const aliases = rootAliases(home, options.allowRootAliases);
@@ -14840,11 +14987,16 @@ function planAgentIntegration(options) {
   const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join17(home, ".codex", "config.toml"), aliases)) ?? "") : {};
   const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
   const observedNativeSources = [];
-  const codexPluginSkills = options.codexNativeCatalog ? reviewCodexPluginSkillControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join17(entry.path, "SKILL.md")), canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), resolve10(options.projectDir ?? home), (path) => {
+  const codexPluginControls = options.codexNativeCatalog ? reviewCodexPluginControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join17(entry.path, "SKILL.md")), canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), resolve10(options.projectDir ?? home), (path) => {
     const bytes = readNativeBytes(path, 1024 * 1024);
     observedNativeSources.push({ path, sha256: sha3(bytes) });
     return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-  }, codexConfig.skills?.config ?? []) : policy.bridge?.codexPluginSkills ?? [];
+  }, codexConfig.skills?.config ?? [], codexConfig.plugins) : { skills: policy.bridge?.codexPluginSkills ?? [], inactivePlugins: policy.bridge?.codexInactivePlugins ?? [], sourceInputs: policy.bridge?.discovery?.codex?.codexInstallationInputs?.plugins ?? [] };
+  const codexPluginSkills = codexPluginControls.skills;
+  const codexInactivePlugins = codexPluginControls.inactivePlugins;
+  const codexDiscovery = discoveries.find((binding) => binding.agent === "codex");
+  const codexPluginSourceInputs = codexPluginControls.sourceInputs.filter((input) => codexDiscovery?.method === "reviewed" && codexDiscovery.roots.some((root) => root === input.sourceRoot || root.startsWith(input.sourceRoot + sep5) || input.sourceRoot.startsWith(root + sep5)) && codexDiscovery.sources.some((source) => source.path === join17(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined));
+  assertCodexInstallationInputs(home, [options.projectDir ?? home], codexPluginSourceInputs.map((input) => input.sourceRoot));
   const changes = [];
   for (const agent of [...new Set(options.agents)]) {
     if (!INTEGRATION_AGENTS.includes(agent))
@@ -14909,7 +15061,16 @@ function planAgentIntegration(options) {
         changes.push({ path: configPath, before: previous, after: next });
     }
   }
-  const discoveryAfter = discoveries.map((binding) => rebindAgentDiscovery(binding, new Map(changes.map((change) => [change.path, change.after]))));
+  const codexPluginSkillReview = options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha3(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join17(home, ".codex/config.toml"), aliases))?.before === null ? null : sha3(readOptional(canonicalAgentPath(join17(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview;
+  const discoveryAfter = discoveries.map((binding) => {
+    const rebound = rebindAgentDiscovery(binding, new Map(changes.map((change) => [change.path, change.after])));
+    if (binding.agent !== "codex")
+      return rebound;
+    const { codexInstallationInputs: previousInputs, ...current } = rebound;
+    const inputs = codexPluginSourceInputs.map((input) => input.sourceRoot);
+    const directories = options.codexNativeCatalog || !previousInputs ? captureDiscoveryDirectories((binding.directories ?? []).filter((directory) => inputs.some((root) => root.startsWith(directory.path + sep5))).map((directory) => directory.path), inputs) : previousInputs.directories;
+    return codexPluginSourceInputs.length ? { ...current, codexInstallationInputs: { version: "codex-cli 0.160.0", catalogSha256: codexPluginSkillReview.catalogSha256, plugins: codexPluginSourceInputs, ...directories?.length ? { directories } : {} } } : current;
+  });
   const nextPolicy = { ...policy, version: 1, loading: "cli", profileId, bridge: {
     ...policy.bridge,
     version: CLI_BRIDGE_VERSION,
@@ -14922,7 +15083,7 @@ function planAgentIntegration(options) {
     profiles: Object.fromEntries([...new Set([...priorAgents, ...options.agents])].sort().map((agent) => [agent, bindings.get(agent)?.profileId ?? policy.bridge?.profiles?.[agent] ?? policy.profileId])),
     disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join17(home, ".codex", "skills", ".system"), aliases) + sep5)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
     rootAliases: aliases,
-    ...codexPluginSkills.length ? { codexPluginSkills, codexPluginSkillReview: options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha3(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join17(home, ".codex/config.toml"), aliases))?.before === null ? null : sha3(readOptional(canonicalAgentPath(join17(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview } : {},
+    ...options.codexNativeCatalog || codexPluginSkills.length || codexInactivePlugins.length || codexPluginSourceInputs.length ? { codexPluginSkills, codexInactivePlugins, codexPluginSkillReview } : {},
     discovery: { ...policy.bridge?.discovery, ...Object.fromEntries(discoveryAfter.map((binding) => [binding.agent, binding])) }
   } };
   const serializedPolicy = serializeManagedSkillPolicy(nextPolicy);
@@ -15413,7 +15574,12 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
     throw new Error("NATIVE_SKILL_DRIFT: the Codex CLI bridge is disabled; run skills hook install");
   if (agent === "codex" && !reviewedCodexPluginCapabilitiesUnchanged(canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024))))
     throw new Error("NATIVE_SKILL_DRIFT: reviewed native plugin capability controls changed; run skills hook install with a fresh discovery review");
-  const disabledPlugin = (entry) => agent === "codex" && entry.vendor && isReviewedCodexPluginSkillDisabled(join17(entry.path, "SKILL.md"), canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], codexConfig.skills?.config, (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
+  const disabledPlugin = (entry) => {
+    if (agent !== "codex" || !entry.vendor)
+      return false;
+    const document2 = join17(entry.path, "SKILL.md"), cache = canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), read2 = (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024));
+    return isReviewedCodexPluginInactive(document2, cache, binding.codexInactivePlugins ?? [], codexConfig.plugins, codexConfig.skills?.config ?? [], read2) || isReviewedCodexPluginSkillDisabled(document2, cache, binding.codexPluginSkills ?? [], codexConfig.skills?.config, read2);
+  };
   const disabledPaths = new Set(disabledCodexSkillPaths(codexConfig, aliases));
   const disabledVendorSkill = (entry) => {
     if (agent !== "codex" || !entry.vendor)
@@ -15450,7 +15616,15 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
   } catch (error) {
     throw new Error(`NATIVE_SKILL_DRIFT: ${error.message}`);
   }
-  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [], disabledVendorSkill: disabledPlugin });
+  let installationInputRoots = [];
+  if (agent === "codex") {
+    try {
+      installationInputRoots = reviewedCodexPluginSourceRoots(canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), discovery.codexInstallationInputs?.plugins ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
+    } catch {
+      throw new Error("NATIVE_SKILL_DRIFT: native installation input identity changed; review discovery and catalog");
+    }
+  }
+  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0, disabledVendorPaths: agent === "codex" ? disabledCodexSkillPaths(codexConfig, aliases) : [], disabledVendorSkill: disabledPlugin, codexInstallationInputRoots: installationInputRoots });
   const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledVendorSkill(entry));
   if (unexpected.length) {
     const paths = unexpected.slice(0, 3).map((entry) => {
@@ -18134,8 +18308,16 @@ function verifyAgentDiscovery(binding, codexRecovery) {
     throw new Error("Invalid native discovery binding");
   if (binding.agent === "hermes" && !binding.directories?.length)
     throw new Error("Hermes discovery requires directory membership coverage; run skills hook install with a fresh discovery review");
-  if (binding.directories !== undefined)
-    verifyDiscoveryDirectories(binding.directories);
+  const installationRoots = codexInstallationRoots(binding);
+  const installationInput = (path) => installationRoots.some((root2) => path === root2 || path.startsWith(root2 + sep6));
+  if (binding.directories !== undefined) {
+    const projected2 = binding.codexInstallationInputs?.directories ?? [];
+    const ancestors2 = binding.directories.filter((directory) => installationRoots.some((root2) => root2.startsWith(directory.path + sep6)));
+    if (projected2.length !== ancestors2.length || projected2.some((directory) => !ancestors2.some((original) => original.path === directory.path)))
+      throw new Error("Missing installation input directory projection");
+    verifyDiscoveryDirectories(binding.directories.filter((directory) => !installationInput(directory.path) && !ancestors2.includes(directory)));
+    verifyDiscoveryDirectories(projected2, installationRoots);
+  }
   const budget = discoveryByteBudget();
   for (const source of binding.sources) {
     assertMarketplaceBinding(binding, source);
@@ -18145,6 +18327,10 @@ function verifyAgentDiscovery(binding, codexRecovery) {
       throw new Error("Invalid native discovery projection");
     if (source.sha256 !== null && !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Invalid native discovery digest");
+    if (installationInput(source.path)) {
+      safe4(source.path);
+      continue;
+    }
     const current = projected(source, undefined, budget);
     if (current !== source.sha256 && !verifiesCodexHookDiscoverySource(binding, source, current, codexRecovery))
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
@@ -18152,6 +18338,27 @@ function verifyAgentDiscovery(binding, codexRecovery) {
   for (const root2 of binding.roots)
     safe4(root2);
 }
+function codexInstallationRoots(binding) {
+  const proof = binding.codexInstallationInputs;
+  if (proof === undefined)
+    return [];
+  if (binding.agent !== "codex" || binding.method !== "reviewed" || proof.version !== "codex-cli 0.160.0" || !/^[a-f0-9]{64}$/.test(proof.catalogSha256) || !Array.isArray(proof.plugins) || !proof.plugins.length)
+    throw new Error("Invalid native installation input proof");
+  const cache = dirname17(dirname17(proof.plugins[0].pluginParent));
+  const config = join27(dirname17(dirname17(cache)), "config.toml"), home = dirname17(dirname17(dirname17(cache)));
+  const configSource = binding.sources.find((source) => source.path === config && source.sha256 !== null && (!source.format || source.format === "toml" && source.fields?.includes("plugins")));
+  const nativeRoots = NATIVE_SKILL_ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => join27(home, path));
+  if (!configSource || proof.plugins.some((input) => nativeRoots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep6) || input.sourceRoot.startsWith(root2 + sep6)) || binding.sources.some((source) => basename9(source.path) === "config.toml" && (source.path === input.sourceRoot || source.path.startsWith(input.sourceRoot + sep6)))))
+    throw new Error("Native installation input overlaps configuration or loading roots");
+  if (proof.plugins.some((input) => dirname17(dirname17(input.pluginParent)) !== cache || !binding.sources.some((source) => source.path === join27(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined)))
+    throw new Error("Missing native installation input source witness");
+  return reviewedCodexPluginSourceRoots(cache, proof.plugins, (path) => {
+    const text2 = read2(path);
+    if (text2 === null)
+      throw new Error("Missing native installation input");
+    return text2;
+  });
+}
 function assertMarketplaceBinding(binding, source) {
   if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename9(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
@@ -18162,8 +18369,11 @@ function assertMarketplaceBinding(binding, source) {
 }
 function rebindAgentDiscovery(binding, changes) {
   const budget = discoveryByteBudget();
+  const installationRoots = codexInstallationRoots(binding);
   return { ...binding, sources: binding.sources.map((source) => {
     assertMarketplaceBinding(binding, source);
+    if (!changes.has(source.path) && installationRoots.some((root2) => source.path.startsWith(root2 + sep6)))
+      return source;
     const sha2562 = projected(source, changes, budget);
     if (!changes.has(source.path) && sha2562 !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);

package/dist/lib/agent-discovery-directories.d.ts

@@ -4,5 +4,5 @@ export interface DiscoveryDirectory {
     sha256: string | null;
 }
 /** Read-only capture; callers must review both membership and source bytes. */
-export declare function captureDiscoveryDirectories(paths: string[]): DiscoveryDirectory[];
-export declare function verifyDiscoveryDirectories(directories: DiscoveryDirectory[]): void;
+export declare function captureDiscoveryDirectories(paths: string[], excludedRoots?: readonly string[]): DiscoveryDirectory[];
+export declare function verifyDiscoveryDirectories(directories: DiscoveryDirectory[], excludedRoots?: readonly string[]): void;

package/dist/lib/agent-discovery.d.ts

@@ -2,6 +2,7 @@ import type { IntegrationAgent } from "./agent-adapters.js";
 import { type DiscoveryDirectory } from "./agent-discovery-directories.js";
 import { type ManagedPluginRegistrationWitness } from "./plugin-discovery.js";
 import { type CodexHookDiscoveryRecovery } from "./codex-hook-discovery-recovery.js";
+import { type CodexPluginSourceInput } from "./codex-plugin-skill-controls.js";
 export { captureDiscoveryDirectories, type DiscoveryDirectory } from "./agent-discovery-directories.js";
 export interface DiscoverySource {
     path: string;
@@ -18,6 +19,12 @@ export interface AgentDiscoveryBinding {
     directories?: DiscoveryDirectory[];
     method: "automatic" | "reviewed";
     builtinNames?: string[];
+    codexInstallationInputs?: {
+        version: "codex-cli 0.160.0";
+        catalogSha256: string;
+        plugins: CodexPluginSourceInput[];
+        directories?: DiscoveryDirectory[];
+    };
 }
 export interface ReviewedDiscoveryInputs {
     version: 1;

package/dist/lib/agent-integration.d.ts

@@ -117,6 +117,7 @@ export declare function inventoryNativeSkills(home?: string, options?: {
     reviewedCacheAlias?: string;
     disabledVendorPaths?: readonly string[];
     disabledVendorSkill?: (entry: NativeSkillEntry) => boolean;
+    codexInstallationInputRoots?: readonly string[];
 }): NativeSkillEntry[];
 /** Planning is read-only; credentials and unrelated settings never appear in CLI output. */
 export declare function planAgentIntegration(options: {

package/dist/lib/codex-native-skill-catalog.d.ts

@@ -22,8 +22,16 @@ export interface CodexInstalledPlugin {
     localVersion: string | null;
     /** Native remote identity; never a guessed installed cache version. */
     remotePluginId?: string;
-    sourceType?: "remote";
+    sourceType?: "remote" | "local" | "git" | "npm";
+    /** Fingerprint of the complete native nonremote source declaration. */
+    sourceSha256?: string;
+    /** Declared local installation input, distinct from the loaded cache root. */
+    sourcePath?: string;
 }
+/** Codex 0.160 derives remote installed keys from these native scope realms.
+ * A nonremote declaration in one of them cannot prove config-owned enablement:
+ * remote reconciliation may replace enabled even while config stays disabled. */
+export declare function codexPluginSourceIsConfigControlled(plugin: Pick<CodexInstalledPlugin, "id" | "sourceType" | "sourceSha256" | "remotePluginId">): boolean;
 export declare const remotePluginIdentifier: (value: unknown) => value is string;
 /** Project the measured native skills/list contract without retaining descriptions,
  * links, interfaces, errors, or any other untrusted native text. */